HTTP-proxy CONNECT for DoT (and any other TCP-based connections)

[cobratbq]

I'm quite certain that you could use HTTP-proxies that support/allow CONNECT requests to connect to any TCP-based service, e.g. establish the DNS-over-TLS (DoT) connections through HTTP-proxy. CONNECT requests expect the proxy to blindly pass through data in both directions, once the connection is established.

See CONNECT - HTTP | MDN, among other well-known refs.

[jedisct1]

DNSCrypt can use TCP exclusively, but new connections are created for every query, so that would be very slow.

Not sure what the point would be compared to DNS relays that are specifically designed for this.

[cobratbq]

DNSCrypt can use TCP exclusively, but new connections are created for every query, so that would be very slow.

I was responding to the fact that your config points out that http-proxies are used only for DoH. It seems that DoT is an equally fine candidate. Do you also establish a new connection to DoT-server on each request?

Not sure what the point would be compared to DNS relays that are specifically designed for this.

Not relevant to my suggestion. I might have put you on the wrong track when I said ".. to any TCP-based services".

Note: I'm not pointing it out because I need it. I'm pointing it out because it may be low-hanging fruit you didn't know existed. (Feel free to close if not interested.)

[jedisct1]

I don't get it. My config? I don't even use DoH 🤨 And DoT was never implemented in dnscrypt-proxy 🤨 Are you sure this (question? suggestion?) was meant for this project?

Yes, there's the HTTP CONNECT method, and even more relevant, the CONNECT-UDP method. But that doesn't seem to be very useful for DNS. Corporations behind these protocols support ODoH and DoOH for DNS instead. dnscrypt-proxy already supports ODoH and DoOH will be added. But that's not very useful over Anonymized DNSCrypt.

[cobratbq]

Oh wow, this is an awkward mix-up of facts. Indeed, without DoT it doesn't make much sense. I remembered mentions of DoT in the public-resolvers.md files, had a quick look at the sources and saw mentions of TLS that seemed to be independent of DoH, saw the remark in the config for .. only for DoH, was aware of support for multiple mechanisms, and I never questioned the DoT support aftewards.